Introducing Argos: Corridor’s First Security Model

Today we’re introducing corridor-argos-1, Corridor’s security context selection model. Argos performs security context selection: it reads a coding agent’s plan and selects the security guidance that applies before the agent writes code. Argos powers Corridor’s Agent Steering, which surfaces this security context into the agent’s plan to steer it toward more secure code by default, so developers have less insecure code to review and fix later.

For this task, we fine-tuned Qwen3.5-9B. On our benchmark, Argos scored 0.655 micro F1, the highest of the 14 models we tested, and had the lowest mean time to first answer token, at 740 ms.

What Argos adds to the agent’s plan

As companies move up the ladder of software autonomy, agents produce more code for teams to review. Our in-house auto-approver helps with review, but every security issue found there still needs a fix and another review. Agent Steering brings security requirements into the coding session so the agent can account for them before opening a PR.

Argos takes an agent’s plan and returns a set of security context items: pieces of guidance that describe project-specific security requirements and, where useful, how to apply them in a particular codebase.

Take an agent plan as simple as “add a file upload endpoint.” Without any additional guidance, the agent still has to decide who can upload, where files can go, and what to do with filenames supplied by the user. Concerningly, the agent can make those implementation decisions without accounting for the proper security requirements.

With Agent Steering, Argos selects the relevant security requirements and surfaces them to the coding agent, helping the agent make more secure implementation decisions.

For our earlier file upload endpoint plan, Argos can return the following security context:

Add the route behind the existing requireAuth middleware. Use getProjectForUser to check that the caller can upload to the destination project before accepting the file. Store it through the shared uploadFile helper, which generates a storage key under the project’s directory instead of using the supplied filename. Apply the app’s 10 MB upload limit before buffering the file.

Now the agent has specific functions to use, an access check to include, and a file-size limit to enforce as it builds the endpoint. Those requirements become part of the implementation plan, reducing the security issues developers have to catch and fix in review. The agent will also request new context as its plan changes throughout the coding session, keeping every new snippet of code secure by default.

Why we fine-tuned a 9B model

Argos has a focused job: read an agent’s plan and select the security context that applies. We wanted to outperform frontier models on this task with the latency of a very small model. Qwen3.5-9B was the strongest open-weight model under 12 billion parameters in our initial security context retrieval evaluation, making it a capable starting point at that size.

We trained Argos with a trace-based workflow supported by smithtune, building a dataset of thousands of synthetic and internal traces paired with relevant security context, including examples where no context applies.

We fine-tuned Argos on Baseten Loops, their managed SFT and RL platform. We monitored our runs there, and when a run finished we deployed the model to an endpoint in one click from the same place. Baseten's team also worked with us to get Argos into production.

Evaluating security context selection

Our benchmark, SecReT (Security Context Relevance Tagging), tests how well a model can perform security context selection. It draws on traces from our product, validated and labeled by a panel of security experts.

We ran the same 272 requests across models, covering 1,910 plan-item pairs. Each request gives the model a plan and a set of candidate security context items, and we score its selections against the labels.

Precision tells us how much of the selected context is relevant. Recall tells us how much of the relevant context the model finds. We use micro F1 as our primary metric to combine both across those decisions.

We gave every model the same selection prompt and used the comparison models’ default reasoning settings.

Model	Reasoning setting
Corridor Argos 1	Thinking off
GPT-6 Sol, Luna, Astra; GPT-5.5	Medium
Claude Opus 5.5	Adaptive, medium
Gemini 3.6 Flash; Gemini 4 Argon	Medium
Gemini 3.1 Flash-Lite	Minimal
Grok 4.7	High
Kimi K3	Max
Kimi K2.5; GLM-4.7; base Qwen3.5-9B	Thinking enabled

Argos has the highest micro f1 of the models we tested, at 0.655. It finds 77.8% of the labeled relevant security context items, with 56.5% precision. We care about both: finding the guidance the agent needs and keeping unrelated items out of its context window. For example, security context about auth can help with a plan that changes access to customer data, but adds little to a plan that changes a frontend button’s color.

Counterintuitively, GPT-6 Luna outperformed Sol, which outperformed Astra, by making fewer, more precise selections. Our hypothesis is that more capable models reason their way into applying security guidance that is only loosely connected to the plan, increasing recall but pulling in more irrelevant context.

Fine-tuning raised Qwen3.5-9B’s micro F1 from 0.480 to 0.655, improving security context selection while keeping the model at 9 billion parameters. Gemini 3.6 Flash led the general models with 0.643, followed by Grok 4.7 and Gemini 4 Argon. This gives us stronger selection quality in a model small enough to serve ourselves for repeated use in the coding session.

Argos 1 was trained in August 2026, and it has held its lead even as newer general models have improved at security context selection.

Steering agents toward more secure code

Argos selects context so the coding agent can use it while implementing a change. For the upload endpoint, that means including the project access check and upload limit as it writes the code. We tested whether providing relevant security context actually improves the security of the resulting implementation.

We used SusVibes, an agentic security benchmark of coding tasks in real repositories, to measure how securely agents write code without special prompting. In our evaluation across nine coding models, agents often produced working code that still failed security tests.

A separate study of AI secure code generation compared models’ understanding of secure coding principles with their ability to apply them in generated code. We see again that models often fail to produce code that is both functional and secure.

To test whether selecting relevant context improves generated code, we used GPT-6 Sol to select the context and write the implementation. In this experiment on SusVibes, we compared five security-context items selected for its plan with five randomly chosen security-context items.

We saw that security correctness rose from 32.8% with random items to 53.2% with selected items, a 20.4 percentage-point increase. The coding agent produced more secure code when it received context selected for its plan. Argos makes that selection available throughout the coding session, bringing the relevant requirements into each new change.

Keeping these checks short and affordable

Each time the agent sends a plan to Argos, it waits for the selected security context before continuing. Keeping that wait short lets us add security guidance throughout a coding session without slowing down the developer’s work. Importantly, Agent Steering helps developers move faster overall by reducing later fixes, without introducing long pauses during implementation.

Full response time

Full response time tells us when the coding agent can continue. Argos returned a complete, validated selection in 2.499 seconds on average, with a 1.373-second median.

Time to first answer token

Time to first answer token shows how much of that wait happens before the selection starts arriving, including time spent reasoning. Argos is the fastest at this, with a mean of 0.74s to begin streaming its response.

Cost and output size

Repeated calls also need to make financial sense. Argos’s 9-billion-parameter base is small enough for us to serve ourselves, and its responses average just 68 generated tokens per call in this benchmark. Our roadmap includes reducing both model size and output length to keep serving costs down as these checks become part of everyday coding.

Inspecting security context selections with LangSmith

How well does context selection work in production? We turned to LangSmith, where we could easily read the agent’s plan, the available security context items, and Argos’s selections together via LangSmith Traces. That made it easy to check each item against the planned change and see the guidance the coding agent would actually receive.

We used LangSmith’s new AI Search to find traces for different types of plans by describing what we wanted to inspect in plain language. For example, querying:

• “Agent plans that deal with auth boundaries” helped us see whether Argos selected context about who could access the resources the agent was changing.

• “Agent plans that do not match security context retrieved” helped us check for items that introduced requirements unrelated to the planned change.

We use LangSmith Engine to analyze and improve Argos and Agent Steering in production. Engine helps us find rare cases where security context is misapplied or relevant guidance is missed, along with opportunities to reduce latency and unnecessary context. We automatically remediate the issues it continuously surfaces, improving how Agent Steering selects context across different security concerns.

What’s next

We’re rolling out corridor-argos-1 to Corridor customers and continuing to evaluate frontier models and train our own where specialization improves the product.

We want developers to hand more work to coding agents and spend less time fixing security issues afterward. Giving the agent relevant security context before it writes code helps it make those decisions earlier. Making that selection fast and affordable lets us keep providing the guidance throughout the session.

If you’re figuring out how to secure the growing share of code your agents write, or working on post-training open-weight models for security, we’d love to talk: corridor.dev.

Acknowledgements

Thank you to Baseten for the Loops SDK, the platform we trained Argos on, and for helping us take it to production.